As cyber attacks grow more complex and sophisticated, new types of malware become more dangerous and challenging to detect. In particular, fileless malware injects malicious code into the physical memory directly without leaving attack traces on disk files. This type of attack is well concealed, and it is difficult to find the malicious code in the static files. For malicious processes in memory, signature-based detection methods are becoming increasingly ineffective. Facing these challenges, this paper proposes a malware detection approach based on convolutional neural network and memory forensics. As the malware has many symmetric features, the saved training model can detect malicious code with symmetric features. The method includes collecting executable static malicious and benign samples, running the collected samples in a sandbox, and building a dataset of portable executables in memory through memory forensics. When a process is running, not all the program content is loaded into memory, so binary fragments are utilized for malware analysis instead of the entire portable executable (PE) files. PE file fragments are selected with different lengths and locations. We conducted several experiments on the produced dataset to test our model. The PE file with 4096 bytes of header fragment has the highest accuracy. We achieved a prediction accuracy of up to 97.48%. Moreover, an example of fileless attack is illustrated at the end of the paper. The results show that the proposed method can detect malicious codes effectively, especially the fileless attack. Its accuracy is better than that of common machine learning methods.

Due to the rapid emergence of malware and its greater harm, the successful execution of malware often brings incalculable losses. Consequently, the detection of malware has become increasingly crucial. The sequence of API calls in software embodies substantial behavioral information, offering significant advantages in the identification of malicious activities. Meanwhile, the capability of automatic feature extraction by deep learning can better mine the features of API call sequences. In the current research, API features remain underutilized, resulting in suboptimal accuracy in API detection. In this paper, we propose a deep-learning-based method for detecting malware using API call sequences. This method transforms the API call sequence into a grayscale image and performs classification in conjunction with sequence features. By leveraging a range of deep-learning algorithms, we extract diverse behavioral information from software, encompassing semantic details, time-series information, API call frequency data, and more. Additionally, we introduce a specialized neural network framework and assess the impact of pixel size on classification effectiveness during the grayscale image-mapping process. The experimental results show that the accuracy of our classification method is as high as 99%. Compared with other malware-detection techniques, especially those based on API call sequences, our method maps API call sequences to gray image analysis and has higher detection accuracy.

With the rapid development of artificial intelligence (AI) in the healthcare industry, the sharing of personal healthcare data plays an essential role in advancing medical AI. Unfortunately, personal healthcare data sharing is plagued by challenges like ambiguous data ownership and privacy leakage. Blockchain, which stores the hash of shared data on-chain and ciphertext off-chain, is treated as a promising approach to address the above issues. However, this approach lacks a flexible and reliable mechanism for incremental updates of the same case data. To avoid the overhead of authentication, access control, and rewards caused by on-chain data changes, we propose a blockchain and trusted execution environment (TEE)-based privacy-preserving sharing scheme for healthcare data that supports incremental updates. Based on chameleon hash and TEE, the scheme achieves reliable incremental updates and verification without changing the on-chain data. In the scheme, for privacy concerns, off-chain data are protected through symmetric encryption, whereas data verification, decryption, and computation are performed within TEE. The experimental results show the feasibility and effectiveness of the proposed scheme.

Memory forensics plays an important role in security and forensic investigations. Hence, numerous studies have investigated Windows memory forensics, and considerable progress has been made. In contrast, research on Linux memory forensics is relatively sparse, and the current knowledge does not meet the requirements of forensic investigators. Existing solutions are not especially sophisticated, and their complicated operation and limited treatment range are unsatisfactory. This paper describes an adaptive approach for Linux memory analysis that can automatically identify the kernel version and recovery symbol information from an image. In particular, given a memory image or a memory snapshot without any additional information, the proposed technique can automatically reconstruct the kernel code, identify the kernel version, recover symbol table files, and extract live system information. Experimental results indicate that our method runs satisfactorily across a wide range of operating system versions.

The dismantling problem and minimum vertex cover (MVC) problem of network are two fundamental NP-hard problems where the former aims to find a minimal subset of nodes whose removal leaves the network broken in small components of sub-extensive size and the latter is also to find a minimal vertex set which contains at least one incident vertex of every edge. Both of them have a wide range of applications related to circuit design, communication, network security, transportation, epidemic control, molecular biology and economics. In this paper, we first propose a novel belief-propagation equation for the spin glass model of the MVC problem. A belief-propagation-guided decimation (BPD) algorithm is then presented which could construct approximate optimal vertex cover of network. In addition, based on the relationship between the network dismantling problem and the MVC problem, we propose a simple and fast algorithm formed by the MVC and a general node reinsertion strategy, for solving the network dismantling problem. The effectiveness of the proposed algorithms is finally verified by comparing with other well-known algorithms on a number of real world networks.

In recent years, the rapid development of blockchain technology has facilitated the transfer of value and asset exchange between different blockchains. However, achieving interoperability among various blockchains necessitates the exploration of cross-chain technology. While cross-chain technology enables asset flow between different blockchains, it also introduces the risk of identity privacy leakage, thus posing a significant threat to user security. To tackle this issue, this article proposes a cross-chain privacy protection scheme that leverages ring signature and relay chain technology. Specifically, this scheme utilizes RCROSS contracts based on ring signatures to handle cross-chain transactions, thereby ensuring the privacy of both parties involved in the transaction. This cross-chain solution demonstrates practicality and efficiency in facilitating cross-chain asset trading. Furthermore, it effectively combats reuse attacks and man-in-the-middle attacks at the application layer while also providing resistance against denial-of-service attacks at the network layer. To validate the proposed cross-chain solution, we conducted tests by constructing a specific cross-chain scenario and by focusing on the natural gas consumption values generated by the RCROSS contract function used in the application chain. The findings indicate that our proposed solution is highly practical in safeguarding the identity privacy of transaction participants. This article’s framework guarantees reliability, security, and efficiency in cross-chain asset transactions. By incorporating ring-based signatures and relay chain technology, users can confidently protect their identity privacy, thus ensuring secure and smooth cross-chain transactions.